Insecure AES Usage: Default ECB Mode and Deterministic Key Generation

[EhsanFir]

这个问题是否已经存在？

• 我已经搜索过现有的问题 (https://gitee.com/risesoft-y9/y9-dataflow/issues)

如何复现

We are security researchers at Digit Institute in Germany. While reviewing [y9-module-dataflow/risenet-y9boot-support-risedata-jpa-repository/src/main/java/net/risesoft/converter/util/Y9Encrytor.java], we identified two cryptographic issues:

Use of Cipher.getInstance("AES") at line 37

Without explicitly specifying the mode and padding, "AES/ECB/PKCS5Padding" is used by default.
ECB mode is insecure as it leaks patterns in the plaintext and should not be used.

Key Generation with Fixed Seed (lines 24, 32)

The encryption key is generated by seeding SecureRandom with a constant value (KEY.getBytes()).
This makes key generation deterministic—if the seed is known, the key is easily reproducible by an attacker.
This amounts to a hardcoded key, which is a severe security risk.

Recommendations:

Always specify a secure mode and padding, such as "AES/CBC/PKCS5Padding" or, preferably, "AES/GCM/NoPadding" for authenticated encryption.
Never seed random number generators with constants for key generation. Instead, use a truly random and secret key generated securely and managed with best practices.
Addressing these will significantly improve the security of your encryption implementation.

预期结果

实际结果

截图或视频

[在这里上传图片]

版本

[panzhaoxiong]

该问题属于AES静态代码扫描漏洞，已修复，可以查看更新对应代码，已在使用的系统更新运行后需要手动重新保存下数据源管理里的数据源密码，因为加密方式不一样导致之前的加密后密码无法使用